In the Metaverse, your identity can be revealed just by moving

Metaverse
(Image credit: Shutterstock / is.a.bella)

New research has uncovered some worrying findings regarding user privacy in Meta's Virtual Reality (VR) ecosystem, the Metaverse; more specifically, that you don't really have any.

Graduate researcher Vivek Nair led a team at the University of California, Berkley, in the largest VR study of it kind at the Center for Responsible Decentralized Intelligence (RDI), analyzing user interactions with VR to determine the levels of privacy.

Most alarming of all, it appears that minimal information is required to pinpoint the individual identities of users, making the preservation of anonymity a real challenge - if Meta and other VR firms are even interested in providing this. 

<a href="https://project.tolunastart.com/tqsruntime/main?surveyData=Q0+ZHk1v+seerVJPB3MBeiu8DEMDIBDHisYB81cDeXB+Tl4/OZ5giQDtZEDgULgE" data-link-merchant="project.tolunastart.com"">TechRadar Pro needs you!
We want to build a better website for our readers, and we need your help! You can do your bit by filling out <a href="https://project.tolunastart.com/tqsruntime/main?surveyData=Q0+ZHk1v+seerVJPB3MBeiu8DEMDIBDHisYB81cDeXB+Tl4/OZ5giQDtZEDgULgE" data-link-merchant="project.tolunastart.com"" data-link-merchant="project.tolunastart.com"">our survey and telling us your opinions and views about the tech industry in 2023. It will only take a few minutes and all your answers will be anonymous and confidential. Thank you again for helping us make TechRadar Pro even better.

D. Athow, Managing Editor

Kinetic fingerprints

When it comes to VR and privacy, previous studies have focused on the myriad of cameras and microphones within them, that can recognize faces, voices and the surroundings of the user. Looking forward, privacy advocates are also worried about the emergence of advanced brain scanning technologies that can be incorporated within headsets. 

But, as the UC Berkeley research shows, none of that is even needed to reveal someone's identity - all that's needed is simply the movement data of the user's head and hands.

Over 50,000 subjects were studied, with over 2.5 million VR data recordings associated with them when playing the VR game Beat Saber, which requires near-constant movement from the hands and sometimes the head. 

With only 100 seconds taken from this motion data, individuals could be uniquely identified with a staggering 94% accuracy, by using advanced AI analysis. What's more, over half could be identified with only two seconds worth of data.

This means that people's movements can be used as a unique identifier, much like a fingerprint. However, as some have pointed out, this movement data may actually be more accurate than a fingerprint, with most common devices able to correctly identify an individual out of less than 1500 others. 

Moreover, such VR data can also be used to determine the dominant hand, height and even gender of the user with a high degree of accuracy. Combined with yet more data that VR systems generally collect, and you have a real problem with being able to maintain any sort of privacy whatsoever. 

If the Metaverse does expand to the point that Meta hopes it will, then the issue of preserving privacy will be greatly magnified. For instance, if online shopping is conducted in VR, then the store will be able to tell how you are just by how you move around its virtual shop floor. 

VentureBeat spoke to Nair about the issue, and said that the problem is "the streaming of motion data is a fundamental part of how the metaverse currently works.”

Some solutions have been put forward to prevent the abandonment of user privacy in VR. One is to obfuscate the motion data as it travels to external servers. However, this would mean the introduction of noise, which could hamper the precision of VR headsets and controllers in detecting user movement, which would be a problem for games like the aforementioned Beat Saber which require these to the utmost. 

Another is to enforce regulation that prevents Meta and other companies from collecting this data, but getting this through would not be easy, given how entrenched big tech companies are in harvesting all sorts of user data.

The Berkeley researchers are also looking into techniques that could be used to maintain user privacy by masking uniquely identifiable movement data without compromising the precision and effective operation of VR devices. 

Lewis Maddison
Staff Writer

Lewis Maddison is a Staff Writer at TechRadar Pro. His area of expertise is online security and protection, which includes tools and software such as password managers. 


His coverage also focuses on the usage habits of technology in both personal and professional settings - particularly its relation to social and cultural issues - and revels in uncovering stories that might not otherwise see the light of day.


He has a BA in Philosophy from the University of London, with a year spent studying abroad in the sunny climes of Malta.